[linux-2.6-block.git] / drivers / misc / lkdtm / refcount.c

// SPDX-License-Identifier: GPL-2.0
/*
 * This is for all the tests related to refcount bugs (e.g. overflow,
 * underflow, reaching zero untested, etc).
 */
#include "lkdtm.h"
#include <linux/refcount.h>

#ifdef CONFIG_REFCOUNT_FULL
#define REFCOUNT_MAX		(UINT_MAX - 1)
#define REFCOUNT_SATURATED	UINT_MAX
#else
#define REFCOUNT_MAX		INT_MAX
#define REFCOUNT_SATURATED	(INT_MIN / 2)
#endif

static void overflow_check(refcount_t *ref)
{
	switch (refcount_read(ref)) {
	case REFCOUNT_SATURATED:
		pr_info("Overflow detected: saturated\n");
		break;
	case REFCOUNT_MAX:
		pr_warn("Overflow detected: unsafely reset to max\n");
		break;
	default:
		pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
	}
}

/*
 * A refcount_inc() above the maximum value of the refcount implementation,
 * should at least saturate, and at most also WARN.
 */
void lkdtm_REFCOUNT_INC_OVERFLOW(void)
{
	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);

	pr_info("attempting good refcount_inc() without overflow\n");
	refcount_dec(&over);
	refcount_inc(&over);

	pr_info("attempting bad refcount_inc() overflow\n");
	refcount_inc(&over);
	refcount_inc(&over);

	overflow_check(&over);
}

/* refcount_add() should behave just like refcount_inc() above. */
void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
{
	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);

	pr_info("attempting good refcount_add() without overflow\n");
	refcount_dec(&over);
	refcount_dec(&over);
	refcount_dec(&over);
	refcount_dec(&over);
	refcount_add(4, &over);

	pr_info("attempting bad refcount_add() overflow\n");
	refcount_add(4, &over);

	overflow_check(&over);
}

/* refcount_inc_not_zero() should behave just like refcount_inc() above. */
void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
{
	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);

	pr_info("attempting bad refcount_inc_not_zero() overflow\n");
	if (!refcount_inc_not_zero(&over))
		pr_warn("Weird: refcount_inc_not_zero() reported zero\n");

	overflow_check(&over);
}

/* refcount_add_not_zero() should behave just like refcount_inc() above. */
void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
{
	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);

	pr_info("attempting bad refcount_add_not_zero() overflow\n");
	if (!refcount_add_not_zero(6, &over))
		pr_warn("Weird: refcount_add_not_zero() reported zero\n");

	overflow_check(&over);
}

static void check_zero(refcount_t *ref)
{
	switch (refcount_read(ref)) {
	case REFCOUNT_SATURATED:
		pr_info("Zero detected: saturated\n");
		break;
	case REFCOUNT_MAX:
		pr_warn("Zero detected: unsafely reset to max\n");
		break;
	case 0:
		pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
		break;
	default:
		pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
	}
}

/*
 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
 * zero it should either saturate (when inc-from-zero isn't protected)
 * or stay at zero (when inc-from-zero is protected) and should WARN for both.
 */
void lkdtm_REFCOUNT_DEC_ZERO(void)
{
	refcount_t zero = REFCOUNT_INIT(2);

	pr_info("attempting good refcount_dec()\n");
	refcount_dec(&zero);

	pr_info("attempting bad refcount_dec() to zero\n");
	refcount_dec(&zero);

	check_zero(&zero);
}

static void check_negative(refcount_t *ref, int start)
{
	/*
	 * CONFIG_REFCOUNT_FULL refuses to move a refcount at all on an
	 * over-sub, so we have to track our starting position instead of
	 * looking only at zero-pinning.
	 */
	if (refcount_read(ref) == start) {
		pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
			start);
		return;
	}

	switch (refcount_read(ref)) {
	case REFCOUNT_SATURATED:
		pr_info("Negative detected: saturated\n");
		break;
	case REFCOUNT_MAX:
		pr_warn("Negative detected: unsafely reset to max\n");
		break;
	default:
		pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
	}
}

/* A refcount_dec() going negative should saturate and may WARN. */
void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
{
	refcount_t neg = REFCOUNT_INIT(0);

	pr_info("attempting bad refcount_dec() below zero\n");
	refcount_dec(&neg);

	check_negative(&neg, 0);
}

/*
 * A refcount_dec_and_test() should act like refcount_dec() above when
 * going negative.
 */
void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
{
	refcount_t neg = REFCOUNT_INIT(0);

	pr_info("attempting bad refcount_dec_and_test() below zero\n");
	if (refcount_dec_and_test(&neg))
		pr_warn("Weird: refcount_dec_and_test() reported zero\n");

	check_negative(&neg, 0);
}

/*
 * A refcount_sub_and_test() should act like refcount_dec_and_test()
 * above when going negative.
 */
void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
{
	refcount_t neg = REFCOUNT_INIT(3);

	pr_info("attempting bad refcount_sub_and_test() below zero\n");
	if (refcount_sub_and_test(5, &neg))
		pr_warn("Weird: refcount_sub_and_test() reported zero\n");

	check_negative(&neg, 3);
}

static void check_from_zero(refcount_t *ref)
{
	switch (refcount_read(ref)) {
	case 0:
		pr_info("Zero detected: stayed at zero\n");
		break;
	case REFCOUNT_SATURATED:
		pr_info("Zero detected: saturated\n");
		break;
	case REFCOUNT_MAX:
		pr_warn("Zero detected: unsafely reset to max\n");
		break;
	default:
		pr_info("Fail: zero not detected, incremented to %d\n",
			refcount_read(ref));
	}
}

/*
 * A refcount_inc() from zero should pin to zero or saturate and may WARN.
 * Only CONFIG_REFCOUNT_FULL provides this protection currently.
 */
void lkdtm_REFCOUNT_INC_ZERO(void)
{
	refcount_t zero = REFCOUNT_INIT(0);

	pr_info("attempting safe refcount_inc_not_zero() from zero\n");
	if (!refcount_inc_not_zero(&zero)) {
		pr_info("Good: zero detected\n");
		if (refcount_read(&zero) == 0)
			pr_info("Correctly stayed at zero\n");
		else
			pr_err("Fail: refcount went past zero!\n");
	} else {
		pr_err("Fail: Zero not detected!?\n");
	}

	pr_info("attempting bad refcount_inc() from zero\n");
	refcount_inc(&zero);

	check_from_zero(&zero);
}

/*
 * A refcount_add() should act like refcount_inc() above when starting
 * at zero.
 */
void lkdtm_REFCOUNT_ADD_ZERO(void)
{
	refcount_t zero = REFCOUNT_INIT(0);

	pr_info("attempting safe refcount_add_not_zero() from zero\n");
	if (!refcount_add_not_zero(3, &zero)) {
		pr_info("Good: zero detected\n");
		if (refcount_read(&zero) == 0)
			pr_info("Correctly stayed at zero\n");
		else
			pr_err("Fail: refcount went past zero\n");
	} else {
		pr_err("Fail: Zero not detected!?\n");
	}

	pr_info("attempting bad refcount_add() from zero\n");
	refcount_add(3, &zero);

	check_from_zero(&zero);
}

static void check_saturated(refcount_t *ref)
{
	switch (refcount_read(ref)) {
	case REFCOUNT_SATURATED:
		pr_info("Saturation detected: still saturated\n");
		break;
	case REFCOUNT_MAX:
		pr_warn("Saturation detected: unsafely reset to max\n");
		break;
	default:
		pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
	}
}

/*
 * A refcount_inc() from a saturated value should at most warn about
 * being saturated already.
 */
void lkdtm_REFCOUNT_INC_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_inc() from saturated\n");
	refcount_inc(&sat);

	check_saturated(&sat);
}

/* Should act like refcount_inc() above from saturated. */
void lkdtm_REFCOUNT_DEC_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_dec() from saturated\n");
	refcount_dec(&sat);

	check_saturated(&sat);
}

/* Should act like refcount_inc() above from saturated. */
void lkdtm_REFCOUNT_ADD_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_dec() from saturated\n");
	refcount_add(8, &sat);

	check_saturated(&sat);
}

/* Should act like refcount_inc() above from saturated. */
void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
	if (!refcount_inc_not_zero(&sat))
		pr_warn("Weird: refcount_inc_not_zero() reported zero\n");

	check_saturated(&sat);
}

/* Should act like refcount_inc() above from saturated. */
void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_add_not_zero() from saturated\n");
	if (!refcount_add_not_zero(7, &sat))
		pr_warn("Weird: refcount_add_not_zero() reported zero\n");

	check_saturated(&sat);
}

/* Should act like refcount_inc() above from saturated. */
void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_dec_and_test() from saturated\n");
	if (refcount_dec_and_test(&sat))
		pr_warn("Weird: refcount_dec_and_test() reported zero\n");

	check_saturated(&sat);
}

/* Should act like refcount_inc() above from saturated. */
void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
{
	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);

	pr_info("attempting bad refcount_sub_and_test() from saturated\n");
	if (refcount_sub_and_test(8, &sat))
		pr_warn("Weird: refcount_sub_and_test() reported zero\n");

	check_saturated(&sat);
}

/* Used to time the existing atomic_t when used for reference counting */
void lkdtm_ATOMIC_TIMING(void)
{
	unsigned int i;
	atomic_t count = ATOMIC_INIT(1);

	for (i = 0; i < INT_MAX - 1; i++)
		atomic_inc(&count);

	for (i = INT_MAX; i > 0; i--)
		if (atomic_dec_and_test(&count))
			break;

	if (i != 1)
		pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
	else
		pr_info("atomic timing: done\n");
}

/*
 * This can be compared to ATOMIC_TIMING when implementing fast refcount
 * protections. Looking at the number of CPU cycles tells the real story
 * about performance. For example:
 *    cd /sys/kernel/debug/provoke-crash
 *    perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
 */
void lkdtm_REFCOUNT_TIMING(void)
{
	unsigned int i;
	refcount_t count = REFCOUNT_INIT(1);

	for (i = 0; i < INT_MAX - 1; i++)
		refcount_inc(&count);

	for (i = INT_MAX; i > 0; i--)
		if (refcount_dec_and_test(&count))
			break;

	if (i != 1)
		pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
	else
		pr_info("refcount timing: done\n");
}
Commit	Line	Data
aeef9c09	1	// SPDX-License-Identifier: GPL-2.0
95925c99 KC	2	/*
	3	* This is for all the tests related to refcount bugs (e.g. overflow,
	4	* underflow, reaching zero untested, etc).
	5	*/
	6	#include "lkdtm.h"
	7	#include <linux/refcount.h>
	8
	9	#ifdef CONFIG_REFCOUNT_FULL
	10	#define REFCOUNT_MAX (UINT_MAX - 1)
	11	#define REFCOUNT_SATURATED UINT_MAX
	12	#else
	13	#define REFCOUNT_MAX INT_MAX
	14	#define REFCOUNT_SATURATED (INT_MIN / 2)
	15	#endif
	16
	17	static void overflow_check(refcount_t *ref)
	18	{
	19	switch (refcount_read(ref)) {
	20	case REFCOUNT_SATURATED:
	21	pr_info("Overflow detected: saturated\n");
	22	break;
	23	case REFCOUNT_MAX:
	24	pr_warn("Overflow detected: unsafely reset to max\n");
	25	break;
	26	default:
	27	pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
	28	}
	29	}
	30
	31	/*
	32	* A refcount_inc() above the maximum value of the refcount implementation,
	33	* should at least saturate, and at most also WARN.
	34	*/
	35	void lkdtm_REFCOUNT_INC_OVERFLOW(void)
	36	{
	37	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
	38
	39	pr_info("attempting good refcount_inc() without overflow\n");
	40	refcount_dec(&over);
	41	refcount_inc(&over);
	42
	43	pr_info("attempting bad refcount_inc() overflow\n");
	44	refcount_inc(&over);
	45	refcount_inc(&over);
	46
	47	overflow_check(&over);
	48	}
	49
	50	/* refcount_add() should behave just like refcount_inc() above. */
	51	void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
	52	{
	53	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
	54
	55	pr_info("attempting good refcount_add() without overflow\n");
	56	refcount_dec(&over);
	57	refcount_dec(&over);
	58	refcount_dec(&over);
	59	refcount_dec(&over);
	60	refcount_add(4, &over);
	61
	62	pr_info("attempting bad refcount_add() overflow\n");
	63	refcount_add(4, &over);
	64
	65	overflow_check(&over);
66	}
67
68	/* refcount_inc_not_zero() should behave just like refcount_inc() above. */
69	void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
70	{
71	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
72
73	pr_info("attempting bad refcount_inc_not_zero() overflow\n");
74	if (!refcount_inc_not_zero(&over))
75	pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
76
77	overflow_check(&over);
78	}
79
80	/* refcount_add_not_zero() should behave just like refcount_inc() above. */
81	void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
82	{
83	refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
84
85	pr_info("attempting bad refcount_add_not_zero() overflow\n");
86	if (!refcount_add_not_zero(6, &over))
87	pr_warn("Weird: refcount_add_not_zero() reported zero\n");
88
89	overflow_check(&over);
90	}
91
92	static void check_zero(refcount_t *ref)
93	{
94	switch (refcount_read(ref)) {
95	case REFCOUNT_SATURATED:
96	pr_info("Zero detected: saturated\n");
97	break;
98	case REFCOUNT_MAX:
99	pr_warn("Zero detected: unsafely reset to max\n");
100	break;
101	case 0:
102	pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
103	break;
104	default:
105	pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
106	}
107	}
108
109	/*
110	* A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
111	* zero it should either saturate (when inc-from-zero isn't protected)
112	* or stay at zero (when inc-from-zero is protected) and should WARN for both.
113	*/
114	void lkdtm_REFCOUNT_DEC_ZERO(void)
115	{
116	refcount_t zero = REFCOUNT_INIT(2);
117
118	pr_info("attempting good refcount_dec()\n");
119	refcount_dec(&zero);
120
121	pr_info("attempting bad refcount_dec() to zero\n");
122	refcount_dec(&zero);
123
124	check_zero(&zero);
125	}
126
127	static void check_negative(refcount_t *ref, int start)
128	{
129	/*
130	* CONFIG_REFCOUNT_FULL refuses to move a refcount at all on an
131	* over-sub, so we have to track our starting position instead of
132	* looking only at zero-pinning.
133	*/
134	if (refcount_read(ref) == start) {
135	pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
136	start);
137	return;
138	}
139
140	switch (refcount_read(ref)) {
141	case REFCOUNT_SATURATED:
142	pr_info("Negative detected: saturated\n");
143	break;
144	case REFCOUNT_MAX:
145	pr_warn("Negative detected: unsafely reset to max\n");
146	break;
147	default:
148	pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
149	}
150	}
151
152	/* A refcount_dec() going negative should saturate and may WARN. */
153	void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
154	{
155	refcount_t neg = REFCOUNT_INIT(0);
156
157	pr_info("attempting bad refcount_dec() below zero\n");
158	refcount_dec(&neg);
159
160	check_negative(&neg, 0);
161	}
162
163	/*
164	* A refcount_dec_and_test() should act like refcount_dec() above when
165	* going negative.
166	*/
167	void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
168	{
169	refcount_t neg = REFCOUNT_INIT(0);
170
171	pr_info("attempting bad refcount_dec_and_test() below zero\n");
172	if (refcount_dec_and_test(&neg))
173	pr_warn("Weird: refcount_dec_and_test() reported zero\n");
174
175	check_negative(&neg, 0);
176	}
177
178	/*
179	* A refcount_sub_and_test() should act like refcount_dec_and_test()
180	* above when going negative.
181	*/
182	void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
183	{
184	refcount_t neg = REFCOUNT_INIT(3);
185
186	pr_info("attempting bad refcount_sub_and_test() below zero\n");
187	if (refcount_sub_and_test(5, &neg))
188	pr_warn("Weird: refcount_sub_and_test() reported zero\n");
189
190	check_negative(&neg, 3);
191	}
192
193	static void check_from_zero(refcount_t *ref)
194	{
195	switch (refcount_read(ref)) {
196	case 0:
197	pr_info("Zero detected: stayed at zero\n");
198	break;
199	case REFCOUNT_SATURATED:
200	pr_info("Zero detected: saturated\n");
201	break;
202	case REFCOUNT_MAX:
203	pr_warn("Zero detected: unsafely reset to max\n");
204	break;
205	default:
917c8c25	206	pr_info("Fail: zero not detected, incremented to %d\n",
95925c99 KC	207	refcount_read(ref));
	208	}
	209	}
	210
	211	/*
	212	* A refcount_inc() from zero should pin to zero or saturate and may WARN.
	213	* Only CONFIG_REFCOUNT_FULL provides this protection currently.
	214	*/
	215	void lkdtm_REFCOUNT_INC_ZERO(void)
	216	{
	217	refcount_t zero = REFCOUNT_INIT(0);
	218
	219	pr_info("attempting safe refcount_inc_not_zero() from zero\n");
	220	if (!refcount_inc_not_zero(&zero)) {
	221	pr_info("Good: zero detected\n");
	222	if (refcount_read(&zero) == 0)
	223	pr_info("Correctly stayed at zero\n");
	224	else
	225	pr_err("Fail: refcount went past zero!\n");
	226	} else {
	227	pr_err("Fail: Zero not detected!?\n");
	228	}
	229
	230	pr_info("attempting bad refcount_inc() from zero\n");
	231	refcount_inc(&zero);
	232
	233	check_from_zero(&zero);
	234	}
	235
	236	/*
	237	* A refcount_add() should act like refcount_inc() above when starting
	238	* at zero.
	239	*/
	240	void lkdtm_REFCOUNT_ADD_ZERO(void)
	241	{
	242	refcount_t zero = REFCOUNT_INIT(0);
	243
	244	pr_info("attempting safe refcount_add_not_zero() from zero\n");
	245	if (!refcount_add_not_zero(3, &zero)) {
	246	pr_info("Good: zero detected\n");
	247	if (refcount_read(&zero) == 0)
	248	pr_info("Correctly stayed at zero\n");
	249	else
	250	pr_err("Fail: refcount went past zero\n");
	251	} else {
	252	pr_err("Fail: Zero not detected!?\n");
	253	}
	254
	255	pr_info("attempting bad refcount_add() from zero\n");
	256	refcount_add(3, &zero);
	257
	258	check_from_zero(&zero);
	259	}
	260
	261	static void check_saturated(refcount_t *ref)
	262	{
	263	switch (refcount_read(ref)) {
	264	case REFCOUNT_SATURATED:
	265	pr_info("Saturation detected: still saturated\n");
	266	break;
	267	case REFCOUNT_MAX:
	268	pr_warn("Saturation detected: unsafely reset to max\n");
	269	break;
	270	default:
271	pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
272	}
273	}
274
275	/*
276	* A refcount_inc() from a saturated value should at most warn about
277	* being saturated already.
278	*/
279	void lkdtm_REFCOUNT_INC_SATURATED(void)
280	{
281	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
282
283	pr_info("attempting bad refcount_inc() from saturated\n");
284	refcount_inc(&sat);
285
286	check_saturated(&sat);
287	}
288
289	/* Should act like refcount_inc() above from saturated. */
290	void lkdtm_REFCOUNT_DEC_SATURATED(void)
291	{
292	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
293
294	pr_info("attempting bad refcount_dec() from saturated\n");
295	refcount_dec(&sat);
296
297	check_saturated(&sat);
298	}
299
300	/* Should act like refcount_inc() above from saturated. */
301	void lkdtm_REFCOUNT_ADD_SATURATED(void)
302	{
303	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
304
305	pr_info("attempting bad refcount_dec() from saturated\n");
306	refcount_add(8, &sat);
307
308	check_saturated(&sat);
309	}
310
311	/* Should act like refcount_inc() above from saturated. */
312	void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
313	{
314	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
315
316	pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
317	if (!refcount_inc_not_zero(&sat))
318	pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
319
320	check_saturated(&sat);
321	}
322
323	/* Should act like refcount_inc() above from saturated. */
324	void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
325	{
326	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
327
328	pr_info("attempting bad refcount_add_not_zero() from saturated\n");
329	if (!refcount_add_not_zero(7, &sat))
330	pr_warn("Weird: refcount_add_not_zero() reported zero\n");
331
332	check_saturated(&sat);
333	}
334
335	/* Should act like refcount_inc() above from saturated. */
336	void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
337	{
338	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
339
340	pr_info("attempting bad refcount_dec_and_test() from saturated\n");
341	if (refcount_dec_and_test(&sat))
342	pr_warn("Weird: refcount_dec_and_test() reported zero\n");
343
344	check_saturated(&sat);
345	}
346
347	/* Should act like refcount_inc() above from saturated. */
348	void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
349	{
350	refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
351
352	pr_info("attempting bad refcount_sub_and_test() from saturated\n");
353	if (refcount_sub_and_test(8, &sat))
354	pr_warn("Weird: refcount_sub_and_test() reported zero\n");
355
356	check_saturated(&sat);
357	}
c7fea488 KC	358
	359	/* Used to time the existing atomic_t when used for reference counting */
	360	void lkdtm_ATOMIC_TIMING(void)
	361	{
	362	unsigned int i;
	363	atomic_t count = ATOMIC_INIT(1);
	364
	365	for (i = 0; i < INT_MAX - 1; i++)
	366	atomic_inc(&count);
	367
	368	for (i = INT_MAX; i > 0; i--)
	369	if (atomic_dec_and_test(&count))
	370	break;
	371
	372	if (i != 1)
	373	pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
	374	else
	375	pr_info("atomic timing: done\n");
	376	}
	377
	378	/*
	379	* This can be compared to ATOMIC_TIMING when implementing fast refcount
	380	* protections. Looking at the number of CPU cycles tells the real story
	381	* about performance. For example:
	382	* cd /sys/kernel/debug/provoke-crash
	383	* perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
	384	*/
	385	void lkdtm_REFCOUNT_TIMING(void)
	386	{
	387	unsigned int i;
	388	refcount_t count = REFCOUNT_INIT(1);
	389
	390	for (i = 0; i < INT_MAX - 1; i++)
	391	refcount_inc(&count);
	392
	393	for (i = INT_MAX; i > 0; i--)
	394	if (refcount_dec_and_test(&count))
	395	break;
	396
	397	if (i != 1)
	398	pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
	399	else
	400	pr_info("refcount timing: done\n");
	401	}